5a6abc54cca03dbe3db784f17c19bba5c452571dd2c11c5cc55930380e54a097

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f86010db6151ac51fe798a73373eef_JaffaCakes118.html
Size

13KB
MD5

68f86010db6151ac51fe798a73373eef
SHA1

45fc6dba281a19cdea0701e109a7ce81217959d7
SHA256

5a6abc54cca03dbe3db784f17c19bba5c452571dd2c11c5cc55930380e54a097
SHA512

df1b69f6326804556fdce05d45ffe1d4329df96ba5554a5b7dec9982468cccccfabf052a356c2734d44662795a2dfaf5f9c76303f8cd416b89176e159020d4ab
SSDEEP

192:huaxZ/MEmNZU6gTs7g72w6Og+zBv12q/zIGq4bhS8nq+k/sTNF16TExkDC3oJy9c:TscS+VBNyaIH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d78367d7ecb4f706541dc65ca3203d5709af37843bda068e0fa739feba3ffc8b000000000e8000000002000020000000ce876da48f5ed2230f81bd97723436fc1e14f22c969223facc07962d92606644900000004804b463ce148ab27baa5a7f8c835cef655e76bd21222a45a49fa4826774246c07d908ae0635f4703a1fb4c70e5f0da107c7da61e3e383daf7bc62dc92b44656e827cdd405ba664556bc7961280c1fc8cd1e3c5ca4aae81862d13c485db04f41f1c9e8304ecaa46fb2936875e7dca3e8e7a8f250391413c223d9ad7c105751d714e3d1c794ec2da28a0a8814f83b2bcc40000000855cd634159318c624a1bbf4f1e79e0603e422d2d475ea05f3bbd22d305e4b736a74d3622191ff6938bec68f2881b4abf05dd4f68109f6f59150d61a3d803819	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427931412"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c4cb956f6313851519590ad3830b7cd65630009af6c679d41ba261eede195ec8000000000e8000000002000020000000bb69566d25dfafc82ed1f2e43983f4291fd6e15299ab6dfe8e054758845a290220000000c3ef4e0dd441814eaf7f1f38a8c8bb98ea7a66df028bc6c7944c2785f332ad654000000056b527a23720e51fe6f655e7b2d6b66221b74720d6ec6f754f368b39fd0fd33ff3a4fd33ae3a39ee7ba2a41a6e9f717a52c9d03335e611e6e44a97b8c90cf775	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6059d30446ddda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30458281-4939-11EF-82B5-E297BF49BD91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2800	2372	iexplore.exe	31
PID 2372 wrote to memory of 2800	2372	iexplore.exe	31
PID 2372 wrote to memory of 2800	2372	iexplore.exe	31
PID 2372 wrote to memory of 2800	2372	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68f86010db6151ac51fe798a73373eef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c7811335c6408d4026dd36d059f8d6

SHA1
0638bf289a74a7d782912db925edea5762d2895c

SHA256
be2c8e68f76ede7b78843041a632d0ce799e996a08528d5085fed794dd72e5be

SHA512
1646a75ea7adac5083a4691f270b652099ff58d7898c58d49bfecc837112b8de1a224d5f7e162cca86005332921c2102408d91d1eec3c59d2f9d2c9241efccea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e488d0d8e6b6e75d642540bbd8801649

SHA1
aac33305b244c8790901a72e1c31085d52c47fbb

SHA256
70008591f335823d34b49b4f54718461d2c92120aeee028640a5e2583d999627

SHA512
9613500fb9f8e1723cff1575cfa8b54d2c07cd8b7d1baf363241602660fb792ad21c94e7cb807b6e5e26d948ff24a7a95e24dc01146481319fbecca065a2660b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17eb8626c6843077d720e21a19937ef4

SHA1
d6c1b803035419acdc0ee9dca360734a8675114f

SHA256
2814047cc280b4a6041895540a5606c1f20cc86e4a1e90422ff2ae28d45a1073

SHA512
4a19c2d81abe13887d45be4de50142d9d3a6eb4372bf88ec1c42d25ac8701770943373ddc0d73576f37808b9212547c9246a1e462724e576d84149913f91948c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61fc1104495a3b50a863173e0cc2e267

SHA1
ed689da56c0f8c961c274ccd727b4cd56e1b169a

SHA256
2b8239049627e255f89b71c54cc4135f289879cdf6f83883046afcb47c8d570f

SHA512
d36b9e55152817a859e8cf2a4d57db52e32791c6bb0970f40028c6482e5f9e3c69a36d3f117bbae3d6a9f55c4b2088eb966e426474928094050c6be80957918c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b099fa05b0fc361bbb8334081cf5aaf8

SHA1
0e3394a49e9334ed1725f2953c8254526087486d

SHA256
8b0689791a39d1cfb3e6d5ecce2ff084a2a5878e968b22427f4def312239d897

SHA512
05f65c4e6beb51b83066c8bfa4ce777e949d29a2e4db6ca0fa13a82bc69397a6f1ff9180f352f946bf8439ab60ef55cdf499be423f7789fe58e63893482dc728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0672484c0fe03bd1389ac20e252b6552

SHA1
dca408da1b4ffbd1c1d7d8f9754e49122028c4c7

SHA256
a7eed36a9a79c3e91684d9aff88e78b933ae4251d733422123507e2ca59c63a1

SHA512
9f3e818ffe6846a4931cd29fca9ac6082efc18e7b5fcfade97b783661c7978cf8aa1d26860eac58bbd7b93881664f3124c5dd46209da11f907437599c92a88d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dbbdadd5cfde13b08b19342a33d9f7e

SHA1
74b42c0b25235448044a130fdbfc0c80420b6146

SHA256
934cf9cc92bb31acfc16f257a6a326a7271192953a5cd9d7d59dfdb99b8e8da7

SHA512
20641bbf9b0331f28ef396cf65572d8a9914b6a348beee5fcf0d1942481b34ba0c679918384831476e1f557c86879f8af6e8ba18da4df1e326fed787f567bc1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d8700a67c066558ac28a176e30e34b7

SHA1
ed3fb5b89f036d796afc11dc3f837d2cd43f7c25

SHA256
6e60aa49516564550716828a76ce02a11a39c2535736a1105122254f215df31b

SHA512
50c167e0887f8570bc72ac0deed0f26914cf4c213e7f95c39db117efa03fb29911f4a55235121fcc3ba4bb13d6c496771d2b19ece38f30c3cbd4e68fc9efc780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf7885105f0b789747b92d5de4c37e8

SHA1
a545c96f7570e31eb4c04a2f005670b3e9e2fd42

SHA256
f9e77b39d1f32e99f7da8d55623e69c832b730c3e33b4e8255373f5cf25fbf0b

SHA512
ad19c41af6e003b397ec439d73f66d7f8bdbfd98174f836e3a109d353b594da92a7db82e90db107e9539fb084ac9cfd238089198d3dab2ded0bf1176636670da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da87006f4ffca9a0493c8e9ad1ffa868

SHA1
47c78730db59c5f0095e89320576fffea8e70b87

SHA256
40eb83d1a0ec777ed2ae37d4a8ff7dbf11fe3e12b9becd8dff3395ddc0433250

SHA512
4e2dff31b433fb635b7815cb88c91c11b8957a77a39e1d288e5e0cb7dca93846a462c1027151f6b964a6518afc29ad9a569b3dec285ea4b2948981b774adb286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d177002652b799dbdb7293972f904809

SHA1
d0dc32307bdf34af59e796ab8f63b39646f39c95

SHA256
3d08f124015b57ac635ea7ae60c5f38b3af662dc51e6935aa75c82165fb89954

SHA512
095d7bc423d8163b6ef032c74bfbd0139b8d74649a7352c3da9b9e7e6800586a61e3ccf0e6c11cdef59e6a58e7ac6ae77521ffaf9ea2f6d3c8fe93a74de09e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCB9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD1A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit